Nope. It is completely realistic as long as you keep the chain of dependencies manageable. To vet dependencies properly you have to stop using thousands of the

Nope. It is completely realistic as long as you keep the chain of dependencies manageable. To vet dependencies properly you have to stop using thousands of them willy-nilly. To stop using thousands of them you mostly have to change only your development dependencies. Runtimes dependencies, even in large Javascript projects, are often well behaved and are rarely a big issue. Except maybe for a few large backend frameworks. No, that won't destroy your company. Anything that helps vetting will be more than welcome, though.